Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

  • High max 9.1
    ELSA-2025-9329 1 CVE

    Important: perl-YAML-LibYAML security update (Oracle Linux 8)

    [1:0.70-2] - Use 3-arg form of open in LoadFile (CVE-2025-40908)

  • Medium max 5.9
    ELSA-2025-9430 1 CVE

    Moderate: krb5 security update (Oracle Linux 9)

    [1.21.1-8.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.21.1-9] - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from…

  • Medium max 6.5
    ELSA-2025-9432 1 CVE

    Moderate: iputils security update (Oracle Linux 9)

    [20210202-11.0.1.1] - Upstream backport 'ping: Add SA_RESTART to sa_flags' [Orabug: 34573399] [20210202-11.1] - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335) [20210202-11] - ping: Fix ping6 bindin…

  • Medium max 5.4
    ELSA-2025-9434 1 CVE

    Moderate: mod_proxy_cluster security update (Oracle Linux 9)

    [1.3.22-1.el9_6.1] - Resolves: RHEL-81070 Rebase mod_proxy_cluster to upstream 1.3.22.Final release [1.3.20-1] - Rebase mod_cluster to upstream 1.3.20.Final tag - Related: RHEL-27497 - Rebase to upstream 1.3.20.Final release

  • Medium max 7.8
    ELSA-2025-9448 1 CVE

    Moderate: emacs security update (Oracle Linux 9)

    [1:27.2-14.el9_6.2] - Restore definition of variable 'enable-dir-local-variables' (RHEL-92653) [1:27.2-14.el9_6.1] - Bump Z-stream release [1:27.2-14] - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) [1:27.2-13] - Bump release [1:27.2-12] …

  • Medium max 4.0
    ELSA-2025-9431 1 CVE

    Moderate: libarchive security update (Oracle Linux 9)

    [3.5.3-5] - Resolves: CVE-2025-25724

  • Medium max 8.4
    ELSA-2025-9462 1 CVE

    Moderate: qt5-qtbase security update (Oracle Linux 9)

    [5.15.9-11] - qt5: QtCore Assertion Failure Denial of Service Resolves: RHEL-96233

  • High max 8.8
    ELSA-2025-9517 1 CVE

    Important: perl-File-Find-Rule security update (Oracle Linux 9)

    [0.34-19.1] - Use 3 arg open in grep() (CVE-2011-10007) - Package tests

  • High max 7.8
    ELSA-2025-9526 1 CVE

    Important: pam security update (Oracle Linux 9)

    [1.5.1-25.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534] [1.5.1-25] - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96729

  • High max 5.3
    ELSA-2025-8625 1 CVE

    Important: perl-FCGI security update (Oracle Linux 7)

    [1:0.74-8.0.1] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) [Orabug: 38047531]

  • High max 8.1
    ELSA-2025-9074 7 CVEs

    Important: firefox security update (Oracle Linux 7)

    [128.11.0-1.0.1] - Update to 128.11.0 [Orabug: 38077559][CVE-2025-5263][CVE-2025-5264] [CVE-2025-5266][CVE-2025-5267][CVE-2025-5268][CVE-2025-5269]

  • High max 7.8
    ELSA-2025-9305 5 CVEs

    Important: xorg-x11-server and xorg-x11-server-Xwayland security update (Oracle Linux 8)

    xorg-x11-server [1.20.11-26] - CVE fix for: CVE-2025-49175 (RHEL-97273), CVE-2025-49176 (RHEL-97329), CVE-2025-49178 (RHEL-97369), CVE-2025-49179 (RHEL-97422), CVE-2025-49180 (RHEL-97235) xorg-x11-server-Xwayland [21.1.3-18] - CVE fix for: CVE-2025-49175 (RHE…

  • High max 7.8
    ELSA-2025-9392 5 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.15.0-7] - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension Resolves: RHEL-97294 [1.15.0-6] - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors Resolves: RHEL-97268…

  • High max 7.0
    ELSA-2025-9327 1 CVE

    Important: libblockdev security update (Oracle Linux 9)

    [2.28-14.0.1] - enable btrfs support [Orabug: 30792917] [2.28-14] - Don't allow suid and dev set on fs resize (CVE-2025-6019) Resolves: RHEL-96038

  • High max 7.5
    ELSA-2025-9396 1 CVE

    Important: mod_auth_openidc security update (Oracle Linux 9)

    [2.4.10-1.el9_6.2] Resolves: RHEL-95948 - mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

  • High max 9.1
    ELSA-2025-9330 1 CVE

    Important: perl-YAML-LibYAML security update (Oracle Linux 9)

    [1:0.82-6.1] - Use 3-arg form of open in LoadFile (CVE-2025-40908)

  • High max 7.8
    ELSA-2025-9303 5 CVEs

    Important: xorg-x11-server and xorg-x11-server-Xwayland security update (Oracle Linux 9)

    xorg-x11-server [1.20.11-31] - CVE fix for: CVE-2025-49175 (RHEL-97289), CVE-2025-49176 (RHEL-97311), CVE-2025-49178 (RHEL-97388), CVE-2025-49179 (RHEL-97410), CVE-2025-49180 (RHEL-97255) [1.20.11-30] - xfree86: Fix potentially NULL reference to platform devi…

  • High max 7.8
    ELSA-2025-9306 5 CVEs

    Important: tigervnc security update (Oracle Linux 9)

    [1.14.1-8] - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension Resolves: RHEL-97305 [1.14.1-7] - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors Resolves: RHEL-97287…

  • Medium max 7.8
    ELSA-2025-9302 5 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-570.23.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.1
    ELSA-2025-3978 1 CVE

    Important: postgresql security update (Oracle Linux 7)

    [9.2.24-9.0.5] - Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain - libpq functions [Orabug: 37843176]

  • High max 5.3
    ELSA-2025-8696 1 CVE

    Important: perl-FCGI:0.78 security update (Oracle Linux 8)

    perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsi…

  • High max 9.1
    ELSA-2025-9188 1 CVE

    Important: idm:DL1 security update (Oracle Linux 8)

    bind-dyndb-ldap [11.6-6] - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa [4.9.13-18.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] [4.9.13-18] - Set krbCanonicalName admin@REALM on the admin user Resolves: RHEL-89895 [4.…

  • High max 8.8
    ELSA-2025-9114 1 CVE

    Important: apache-commons-beanutils security update (Oracle Linux 9)

    * Fri Jun 13 2025 Mikolaj Izdebski <mizdebsk@redhat.com> - Fix improper access control vulnerability - Resolves: CVE-2025-48734

  • High max 7.8
    ELSA-2025-7898 1 CVE

    Important: kernel security update (Oracle Linux 7)

    [3.10.0-1160.119.1.0.9.el7.OL7] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Jeongjun Park) {CVE-2024-53141} [Orabug: 37964173] - Update OL SB certificates - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985797]

  • Medium max 9.1
    ELSA-2025-9142 1 CVE

    Moderate: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns buildah [2:1.33.12-2] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/cf49e7c) - fixes 'CVE-2025-22871 container-tools:rhel8/buildah: Request smuggling due to…

  • High max 7.8
    ELSA-2025-9165 3 CVEs

    Important: gimp:2.8 security update (Oracle Linux 8)

    gimp [2:2.8.22-26.2] - fix CVE-2025-5473 (RHEL-95696) [2:2.8.22-26.1] - fix CVE-2025-48797 (RHEL-93503) - fix CVE-2025-48798 (RHEL-93506) pygobject2 [2.28.7-5] - bump spec to fix NVR pygtk2 [2.24.0-25] - Fix shebang mangling for _prefix=app (#1907579) - disab…

  • Medium max 9.1
    ELSA-2025-9144 1 CVE

    Moderate: podman security update (Oracle Linux 9)

    [5.4.0-10.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [5:5.4.0-10] - rebuild to fix CVE-2025-2287…

  • Medium max 9.1
    ELSA-2025-9147 1 CVE

    Moderate: buildah security update (Oracle Linux 9)

    [1.39.4-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.39.4-2] - rebuild to fix CVE-2025-22871 buildah: Request smuggling due to acceptance of invalid chunked data in net/http - Resolves: RHEL-89294

  • High max 9.1
    ELSA-2025-9184 1 CVE

    Important: ipa security update (Oracle Linux 9)

    [4.12.2-14.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.12.2-14.1] - Resolves: RHEL-89908 EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin i…

  • High max 7.8
    ELSA-2025-9162 3 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:2.99.8-4.2] - fix CVE-2025-5473 (RHEL-95700) [2:2.99.8-4.1] - fix CVE-2025-48797 (RHEL-93521) - fix CVE-2025-48798 (RHEL-93522)

  • High max 9.8
    ELSA-2025-9080 7 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-570.22.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Medium max 9.1
    ELSA-2025-9060 1 CVE

    Moderate: git-lfs security update (Oracle Linux 8)

    [3.4.1-5] - Rebuild with new Golang - Resolves: RHEL-89264

  • High max 5.4
    ELSA-2025-9119 1 CVE

    Important: libvpx security update (Oracle Linux 8)

    [1.7.0-12] - Add patch for double free Resolves: RHEL-93914

  • Medium max 9.1
    ELSA-2025-9106 1 CVE

    Moderate: git-lfs security update (Oracle Linux 9)

    [3.6.1-2] - Rebuild with new Golang - Resolves: RHEL-89304

  • Medium max 9.1
    ELSA-2025-9143 1 CVE

    Moderate: containernetworking-plugins security update (Oracle Linux 9)

    [1:1.6.2-2] - rebuild to fix CVE-2025-22871 containernetworking-plugins: Request smuggling due to acceptance of invalid chunked data in net/http - Resolves: RHEL-90031

  • Medium max 9.1
    ELSA-2025-9145 1 CVE

    Moderate: skopeo security update (Oracle Linux 9)

    [2:1.18.1-2] - rebuild to fix CVE-2025-22871 skopeo: Request smuggling due to acceptance of invalid chunked data in net/http - Resolves: RHEL-89329

  • Medium max 9.1
    ELSA-2025-9150 1 CVE

    Moderate: gvisor-tap-vsock security update (Oracle Linux 9)

    [6:0.8.5-2] - rebuild for CVE-2025-22871 - Resolves: RHEL-90038

  • High max 5.4
    ELSA-2025-9118 1 CVE

    Important: libvpx security update (Oracle Linux 9)

    [1.9.0-9] - Add patch for double free Resolves: RHEL-93908

  • High max 7.5
    ELSA-2025-8817 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 9)

    [9.0.107-1.0.1] - Add support for Oracle Linux [9.0.107-1] - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94424

  • High max 7.5
    ELSA-2025-8844 1 CVE

    Important: mod_security security update (Oracle Linux 8)

    [2.9.6-2] - add fix for CVE-2025-47947 - Resolves: RHEL-93005